Hacker News Reader

Comment by cantrevealname | Hacker News Reader

> "We used a rep that literally done all the work for us"

This is why the privacy and security guarantees of almost all companies, credit bureaus, banks, the IRS, the department of motor vehicles, etc., are worthless. Every customer service rep that works at any of those places -- all 500 or 5000 or 50,000 of them -- can pull up info on anyone at any time. The only thing that prevents that is rules. There are no technical countermeasures.

I'd like to see a system where it is physically impossible for a customer service rep to discover any info about me until I authenticate and authorize it. Or to at least offer me the option to lock my account such that I need to authenticate and authorize before any access is given to the customer service rep.

Does anyone know of customer service panels at big companies or government departments where this is the case? I.e., it is literally impossible for a rep to browse random customer information even if they are willing to break the rules? If it's been done somewhere, it would be interesting to hear how it was implemented.

View on HN

The problem is that customers don't remember basically anything. I don't know my telephone banking password for any bank. When I call, I get asked to tell them what my last transaction was, or my mother's maiden name and DOB (public info), or what town I last used my card. I've been wrong about the recent usage questions more often than I've been right, and they say "close enough".

The technological measures have to account for human behaviour. Otherwise you just end up with almost everyone not being able to access almost everything almost all of the time. People are forgetful, irrational, stubborn and stupid. So are institutions. Put them together and you have a social engineering dream world (literally our current world).

This is a more general and larger problem where society is constantly bending over backwards to cater to the 2% lowest performers.

If you added up all the costs of the people at the lowest extremes (by various metrics), I'd venture to guess that we could increase our prosperity (by various metric) by an order of magnitude.

Example: When I started my startup, we made the decision not to hire any salesperson who wasn't proficient in using a computer (we have no IT support line). We also made the decision to not sell to any customer that couldn't figure out how to use the website (we have no telephone support).

I cannot even tell you how multiplicative the benefits are. The 2% employees who couldn't use a computer or clients who couldn't use the website were responsible for 90% of the issues we had at my prior company. Everything from regulatory complaints, to lawsuits, to ad-hoc report requests, to virus infected PCs, to... the list goes on and on.

Having smart people is great. Not dealing with idiots is equally important.

> This is a more general and larger problem where society is constantly bending over backwards to cater to the 2% lowest performers.

As your parent said, it's not 2%, it's more like everyone. No one is perfect all the time.

More importantly, it's one thing when hiring, but are you seriously suggesting 2% of the population shouldn't be able to use Twitter or online banking or other online services? 140,000,000 people should effectively face social death because you can't be fucked to help them?

This is backwards, we should be sacrificing profits and convenience to be more inclusive.

I think we need to be honest about what the most dysfunctional bottom 1-2% are costing us.

...and it's not correct to say that "everyone is imperfect sometimes" because the correlation between people who are problems across various metrics, is high.

Would you share the plans you have in store to help them cope better with our society?

When I bought my house a couple years ago, I had to put my signature to make a big and urgent money transfer. The bank however didn't accept my signature for some reason, though I had been using it every time with them.

It appeared that normally they not really check if it matches, but this time given the transfer amount they did. And it just so happened that the signature they had scanned in their system was the first one I ever made as a kid (30yrs ago) when I opened the account.

Finally after many retries they turned the monitor to show me the expected signature and let me practice it on a piece of paper, so it would pass some other approval stage.

With a 200 yard line waiting behind me, sweating profusely, I finally managed to reproduce something. The sale went through, luckily, and immediately after I ditched that bank account.

It sounds really useless but requiring a signature means a fraudster would have to forge a signature which is a separate, perhaps more easily proven crime that carries extra penalties.

This kind of poor security is why we need legislation to make banks responsible for financial damages due to identity theft or fraud. When they will be on the hook for potentially millions of dollars, maybe they will care more about security and offer better protections than a signature

> The sale went through, luckily, and immediately after I ditched that bank account.

I believe most banks allow their customers to change their signature to something they can replicate more consistently — but it probably relies on showing up to a branch and producing sufficient ID.

I was told that a bank would not approve a transaction because the signature I had provided in a Word document was not similar enough to the one on file.

Helpfully, they provided me with a screenshot of the one they had on file... one copy and paste later and the problem was resolved.

One copy and paste

> immediately after I ditched that bank account.

Because they showed you the signature and let you practice, right?

Yup, but also because they could have my evolved adult signature on file, or at least asked me after certain time interval to update it for their records.

> “close enough”

I guess one, admittedly brutal, solution is for customers to act like the immune system. Call up, fudge your way through to something that should be protected, and then escalate to a manager and report that you got access to your own account with vague details; they can listen to the call log to verify.

Worst case is that the rep gets fired (which sucks..) but if enough reps get fired then future reps will be hired and trained more diligently.

Whenever I call into E*Trade, first they send me a text with a code. They can't see the code, they just get a box and have to enter in the code I give them and it tells them if they are right.

Then after that I have to read off my 2FA code. In other words, they have to log in with the same 2FA that I do.

So a random customer service rep couldn't access my account without my phone in their hand, even if they managed to clone my SIM to get past the text message check.

I’m not sure habituating people to getting asked for 2FA codes is a good idea. Seems like it’s just going to make people more susceptible to social engineering attacks.

I’ve long considered why apps don’t have some VOIP client in them; if one can Face ID into their account, and use the VOIP client to connect to a rep - then the metadata associated with the call can inform the rep you are who you say you are. Seems E* is almost there!

I may be wrong, but Face ID should be performed entirely in the SEP, and only returns a boolean.

If it only returned a Boolean, it would be impossible to design a secure network authentication protocol with it.

What happens when you forget your code and lose your phone ?

Presumably the process for that is much more involved and fewer people have the power to do it. And if it requires the approval of two higher up people to do then that lowers the risk even further.

And hopefully audited.

I dunno but I have been unable to get back my Gmail account after changing phone numbers, and unable to change email on Netflix account after credit card I used to open account expired.

> Then after that I have to read off my 2FA code.

Whats the point of this step

Make sure that even with a hacked SIM a malicious CSR can't access your account without your knowledge.

Also ensuring that a hacker can get the 2FA token directly from the owner by pretending to be customer service...

Seriously who designed a system that habituates people to giving out 2fa codes over the phone?? That's explicitly a weakness of the 2fa system, nobody should ever read out or forward their 2fa code.

In this case it sounds like the user is calling ETrade, so unless the user calls a wrong number that just so happens to be a hacker it's unlikely this would be an issue.

Actually, that is a very common trick that scammers have used and still do. In the past they would buy Google ads or do some black hat SEO to get their fake number to the top of search engines.

Then, people searching for things like "Microsoft tech support" would get the scammers number and call it. Google and other search engines will even pull that number from your site and handily present it to you at the top of the search results to make it appear even more legit.

Taking over unclaimed Google map listings for businesses is also really common.

Simply buying a toll free number that is close to the customer service number for a large company is bound to get you more inbound callers than you care to scam.

So no, absolutely no excuses for teaching people to share their 2fa codes.

I'm really surprised that this is the top comment right now because even the most basic back of the envelope check shows that it is wrong.

Think about your own life: how often do you lose money because an insider hacked your credit accounts and bank accounts? How often do you get pulled over and your car taken away because someone changed the title/tags in DMV records? How often is your identity stolen by an employee at the IRS?

These bad things all happen to some people, of course, but the VAST majority of the time, they do not.

It is obvious that there are effective countermeasures to prevent and mitigate insider threats. Insider threat is not a new concept, and there are well-proven tactics for addressing it.

I agree with most of your post, but the parent comment is not wrong about customer service panels being accessible by employees. A friend of mine worked at a call center for a major us phone provider, the only thing stopping employees from accessing customer records is a point based penalty system for infractions. While my friend worked there, one employee was caught accessing customer records and was never fired or anything and continued to do shady things until quitting. It was discovered he'd worked at multiple call centers before and did the same thing.

Around the same time, at a nearby call center, two employees were caught ordering multiple manager's laptops, which managers can use to access customer records from their home. These laptops were sent out to multiple addresses and never found.

> Does anyone know of customer service panels at big companies or government departments where this is the case? I.e., it is literally impossible for a rep to browse random customer information even if they are willing to break the rules?

Yes - no names for obvious reasons but where I work (trust me you've heard of them/probably use them and they are a huge tech company) it is very hard to get access to anything even slightly customer related. You need to go through multiple levels of review and approval (often your manager, their manager, and then directors/VPs) with genuine business justifications that actually looked at (no "asdf" here) to get access, and then it is usually only permitted for a window of months at most before it is auto-revoked. Then once you have access, every actual time you look at the data you need to provide justification (e.g. a ticket number that is actually checked to make sure it is open, not reused over and over, and not just 1234567890 etc and so on), and every single action you do with the data is tracked and audited so there is a complete 100% paper trail of who looked at what, when they did it, and why they were doing it, with traceability through to the tickets/bugs/etc for why there were even doing this in the first place. Abnormal things (e.g. systematic/repeated/etc) raises flags that do terrible things to your career. Each system/data source needs its own independent approval process.

There is no "god mode".

It is not uncommon for people to wait weeks for approvals to go through to access their own data to validate a bug fix etc. I think these safeguards are worthwhile - many would see them as a hindrance.

At past places, I implemented a call-centre UI once. We made it so that the service rep would initially not see anything about the customer, so the "Please can you confirm 3rd letter of your memorable word" or whatever meant that the service rep literally had a text box to type that letter in which had to match before they could proceed - they didn't see the whole world on screen and wait to see if the user got it right. I am not sure how common this is - when I do this from the customer side these days often the answer is immediately acknowledged by the rep without any kind of delay or typing noises so I am guessing they have my entire record on their screen and are just waiting for me to say the right things before continuing the call :(

This is very consistent with what I've seen of AWS. Engineers have had to jump through many hoops to look at my account even when I've reported a bug and ask them to look at my account.

This is why IMO Google has almost no customer service. Their weakest attack vector would be people. Imagine paying your infosec employees hundreds of thousands a year to protect your clients data. Next to them (in terms of data access) is your customer service team at $30,000 per head. Which team is easier to crack?

You don't think part of the reason they don't have customer service is that the # of people they'd have to employ is huge?

They do have customer service, if you pay for their premium service Google One. They also have support agents for YouTube creators above a certain subscriber threshold.

For reasons I cannot fully remember my voicemail broke many years ago. It goes something like: I’d switched to google voice for vm, where T-Mobile handled my line generally. Then google did something to google voice, some sort of discontinuation + merging with gmail and my vm broke. This occurred in tandem with me moving to a house with terrible cell reception and before wide spread WiFi calling support. The result was that many folks figured I’d had my number disconnected because calls which couldn’t connect to my phone would get the “disconnected number tone” when being directed to my voicemail box.

Every month or two I’d fill in the google support text area explaining the problem. No response for ~4 years. Just this Feb, for whatever reason, I decided to call T-Mobile and report it. Problem was fixed by a higher up tech that described the problem as “very strange” and the “first time” he’d seen something like this. It took approx. an hour.

Upon rumination I full accept that I took the “easy way out” by filling in the text box vs trying to talk to someone. End result is that google lost a gvoice customer and no one calls me anymore. meh

The only calls I get any more are recruiters (80%) scammers (15%) and family 5%.

My family texts me (whatsapp) asking if/when they can call me.

Recruiters call? I would have expected them to use other more asynchronous methods like text or email, unless you strongly indicate a preference.

At least in the Chicago area, they seem to really prefer to speak on the phone. I'm hard of hearing so phone conversations are challenging at best and despite that, when I've actually been looking for work and talked with recruiters, if they do e-mail it's to ask me to call them. It's seriously annoying. I think a lot of recruiters here have managers who take the view that if they're not on the phone they're not "working."

Recruiters call me a lot in the UK. I assume it's because they're able to command your attention as long as you stay on the line. Emails are easily ignored.

Yeah that sure as hell makes it sound like the reasons for having or not having customer support are economic in nature.

I find it very hard to believe that the "real" reason for Google's shitty customer service is that it's for our own good.

We use OpsGenie at work. I've used their support a couple of times. Every time they needed to look at our company's account settings I've had to approve it (using some sort of OpsGenie internal tool). I was pleasantly surprised. It's impossible to tell as a customer how hard it is to access my data without that internal authorization system, but it at least looks better than nothing.

There is no guarantee though, i.e. the system could be well intentioned but if could be bypassed , it does not really protect.

The only way to get some assurance is run vendor app in your environment in a secure network without the ability to phone home.

Obviously it can be bypassed in the sense that somebody has full administrator database access.

The point about schemes like this is that instead of having to give 1000 support reps full access, you only give a few sysadmins full access. The likelihood of something going wrong with the data (through mistakes, willful abuse, extortion, whatever) goes drastically down.

In fact, once you got such a permission system in place, it becomes very attractive for the organization to use it. I mean, customers love it, they spontaneously write comments about it on Hacker News.

Even if you begin adopting it only for security theater (i.e. everybody still actually has full access), eventually some principled engineer brings up the idea to maybe remove full access for everybody cause now they have the access-granting system anyway, and this time they'll make a convincing case because the "move fast and break things" people have way fewer practical objections.

That's a very 90s view. The modern view is that only robots are sysadmins, and those robots are indirectly controlled. Some humans have superpowers in some systems, but not in the whole system.

> I'd like to see a system where it is physically impossible for a customer service rep to discover any info about me until I authenticate and authorize it.

Isn't this the objective of Tim Berners-Lee Solid Project and their Personal Online Data storage (PODs) in the spec?

https://solidproject.org

No. POD is about who you share with, not what happens after you share.

Thought it was who you share what with, so including the auth/authz as parent asked. After sharing happened all bets are off.

If you have a system where customer service reps are strictly unable to access your data without some kind of cryptographic authentication, that defeats the purpose of customer service for 80% of customers (who suck at using computers and mostly just lose their passwords). If you’re in the other 20%, you might as well use some kind of decentralized cryptographic system with no customer service anyway. This is one of the chief complaints I see against Bitcoin on here - “what if I lose my password?” - the implicit dual to that being that someone else can access your account without your password, and you hope they’re not a bad actor.

Yes but you can mitigate the risk by limiting the rate at which any rep can perform security-impacting operations such as password reset, and by denoting high value accounts as requiring additional manual approval.

I have worked on controls in this area for a few US health insurance companies.

From what I have seen, it is common to have additional restrictions on accessing high profile individuals and specific groups data. There is also a ton of auditing around this stuff.

It is more primitive than what you described, but things are heading in that direction. It is a somewhat harder problem space because many parties need access to a customer's records in that domain.

Ultimately, the only reason things are even this far along in health insurance is the regulatory environment. It'd be nice to have stronger privacy laws that compel companies to build good controls.

I worked for a healthcare claims processing company that at the time stored all the production database and server passwords in a text file accessible to half the company, all because the chief architect didn't want to remember passwords. Yet we were covered by HIPPA and "passed our audits". If people don't care to follow the law and can manipulate the audit, who is going to stop them?

How does a single rep coordinate the mass amount of posts across verified (and non verified?) accounts? That is an insane amount of access for 'a rep'. They can just copy and paste the same message across that level of accounts?

The rep can perform a password reset and/or change the sms/email pair and then attackers can do the rest and make the posts themselves.

One rep does password resets for scores of high value accounts?

Before this incident, protections against that were probably "a good idea at some point, but not near the top of the backlog right now"

There are probably other factors involved, like access to other information used for MFA and compromising those mediums or using information related to them to assume identity.

Each place is different, I guess.

When I worked at Apple Retail, there was an internal iCloud dashboard you could log into and see _metadata_ about customer accounts. You couldn’t see anything juicy, for Find My iPhone/Friends it was just the name of people would could see your location, not locations themselves. Number of documents, not access to actual documents.

But nothing was visible to you until you verified the customer through security questions, last four digits, etc.

I don’t know the details but whenever I call Hover for support, they have to email me a code that I have to read to them to unlock access to my account. If you have 2FA enabled you need to give them that code too. I’m not sure if they are just verifying but it sounds like they actually can’t do anything without the codes.

> Every customer service rep that works at any of those places -- all 500 or 5000 or 50,000 of them -- can pull up info on anyone at any time. The only thing that prevents that is rules. There are no technical countermeasures.

Yup. Doubly so for sysadmins, many of which have abhorrent data security practices.

My personal solution is to use cover names, disposable phone numbers, and unique email addresses (the + trick is insufficient) for most services. My assumption is that the data is eventually either going to leak, or be used to threaten or harm me in some way.

If none of the PII overlaps with me, it becomes a lot harder for such an event to affect me.

The only downside is that sometimes you get companies (Airbnb, Instacart, some others) that have CSRs that demand a government photo ID to do certain tasks. Of course I don’t have any documents for these cover names, so usually the workaround is to just abandon that account, make another, and re-place the order or transaction in a way that doesn’t flag it for manual review/intervention.

Works pretty well for me most of the time.

What are the form of the emails? text@singledomain.com, text@disposible.email.service.com ? What if the service requires constant SMS OTP that you cannot opt out of?

I use both forms, including AnonAddy for the latter. For services that insist on frequent SMS OTP I usually just replace them with a different service, or I use dtmf.io.

Great idea! User accounts are locked by default, and can only be accessed if unlocked, for a limited time period, by the user themselves. For extra security, though more friction, the unlock process generates a time limited access token, provided by the user to the rep, reducing the access surface to just the rep that possesses the token.

Supposedly my credit card company works this way (Chase), though you have to opt in to it when you sign up for two factor authentication. Sprint has the same thing, where they can’t get to anything on my account without passing two measures.

I can’t verify this 100% unfortunately but they are notable because of how rare it is

When I moved from the UK to the US, I left some money in my UK bank account for a bit... A few years later I called up customer service with "Hi can you please transfer all funds to this new account at another bank in another country, and close my UK account? I don't remember any passwords, don't have the 2fa fob you gave me, don't have the phone number you have on file and don't live at the address on file." They asked me when I opened the account, which branch it was at, and who my employer was, and that was all it took. The phone call was under an hour, most of which was spent on hold. All of the required "security" information could be figured out from my public LinkedIn. Scary stuff.

* > Every customer service rep that works at any of those places can pull up info on anyone at any time. *

This is simply not true. For example with banks, high-profile accounts can't be accessed by regular tellers. If someone attempts to, it is logged and someone is notified that Teller X tried to access the account.

Now that Twitter is being used for high-profile official communications, they need to re-design their employee control panels to limit, alert, and control what an employee can do with an account.

The fact that important credentials on so many high-profile verified accounts could be changed without notifying employees or locking the affected accounts until the actions are verified is unacceptable.

It shouldn't just be "high profile" accounts. Every person is susceptible to abuse by insiders, so give the same protections to all.

This was a big problem in the early days of online banking (early ‘00s). A fair number bank fraud losses were due to rogue internal employees at call centers creating or changing then selling off online banking passwords. Ran into this when I was with a startup that launched bank to bank email money transfers in Canada around 2001. Banks cleaned up their security pretty quickly though, adding deyailed audit trails for one, and variety of other security controls around their own employee access (like double sign-offs). There is a general principle that banks have understood for as long as there have been banks... not all threat actors are outside threat actors.

In this case I suspect that there is an audit trail. It will lead to a Twitter insider who was “working from home” and had remote access to the tool, but had already left the country.

Banks just don’t give support reps remote access to accounts.

> Does anyone know of customer service panels at big companies or government departments where this is the case?

E-government services in Estonia have nice features, aimed at giving more control to the owner of the data [1]. Among other: "It allows the Citizen to query who has accessed his/her records. [...] In Estonia, this feature has led to some very public cases of government officials being caught accessing private data of Citizens - without any legitimate and authorized reason for such access."

[1]: https://doi.org/10.1007/s12553-017-0195-1

there are countermeasures. any competent org (agree with you -- probably not the majority of them) have auditing, so accesses are logged. back in the 90s we had this at my university ... it's an age-old practice. you as user would never know it.

i would bet that most of the places you are thinking about (banks, credit card, and so on) where you get on the phone with a rep, with a phone entry system ahead of the agent, the agent can only access that specific data during the call, the access is logged, and any other access (some other account) is flagged for review. by calling in you are granting access. most users simply don't care about privacy and extra hurdles are just asking for complaints. limiting access to specific accounts during live calls is a fair compromise and a tight control.

xero (they suck, so this is not an endorsement) requires you to give the rep access explicitly, as an option, when requesting tech support. of course i have zero doubt that senior reps can get access anyway (which would be audited), so the explicit control is more about signalling comfort to you about their security measures.

after google had the SRE stalker incident they implemented very tight access controls to user data.

i walked into a verizon store the other day to buy a hotspot. the rep could not get access to any info whatsoever (even billing status) until i acknowledged a message on my phone. it's clear they only had access to my specific data (ie, they don't get to enter any phone number and get access) for that specific interaction.

This is something I argue with coworkers et al to no end: differential privileges are targets for privilege escalation!

From their perspective, they want the ability to ban/kick/etc as special powers; but from my perspective that feature is an exploitation target that's vulnerable to any unknown bugs, and probably in twitter's case, social exploitation.

I would _much rather_ see all users be equally powerful and find some means by which the services can be designed such that everyone can be comfortable and safe.

AT&T claims my security PIN will prevent agents and in store associates from accessing my account. The store rep said there’s no way for him to help me doing anything until we called a special hotline to give my PIN and approval.

Doesn’t mean there isn’t a way around it for some reps with special access. If you don’t have a PIN someone can go and open up multiple new accounts separate from your primary account in your name with different addresses. AT&T won’t even bother to tell you.

Wrong! Pin is designed as legal shield against you - it was initially designed because children of parents, disgrunted employees and angry spouses would show up with a phone and wanted access or make changes on that phone account and mere possesion of said phone “authorize” them. Now the terms of service clearly state pin is extra layer to protect your data from oursiders, be it your child or spouse. Meanwhile employees have full or near full access. I know this because my sister is a store manager. They would daily print list of accounts overdue and prepare list for followuos - should would check everyone in computer, their history of payments even zip code where they live and make decision whether to bother them with phonecall now or push it for another day. The only access they dont have is your credit card info. They cant even see the last four, since its separate third party company responsible for payments.

I'm fairly sure most banks operate this way. For example, I think they can't even see your account balance until they have entered phone #, mother's maiden name, etc.

So anyone who gets access to your Facebook profile can see all your bank data.

The problem is that it is all too common for these tools to not be sufficiently prioritized in these organizations. They are usually slapped together without security or much else in mind. They are barely maintained. Security concerns as they surface are addressed by tacking on auditing and authorization instead of more secure architectures.

This is also why you want to have people in IT that can defer judgement if someone posts, does or says something that you do not like. Criminal behavior is another matter of course.

But you would need to educate people with access about the importance of impartial management of user data.

Banks had a culture enforcing neutrality and most importantly discretion. That is not true for modern payment processors like paypal or mastercard though.

You certainly don't want Twitter activists in such a role, regardless of political affiliation.

Such measures are theoretically mandated under GDPR if you have >50 employees. I'm not sure how that looks like in practice though.

I work in banking. You’d be amazed at how serious the information and enterprise architecture is around PII and confidential data.

Reply on news.ycombinator.com